Microsoft Ties ConnectWise Attack to China-Linked Storm-0940 and AI Tool ARTEX: What Is Confirmed

Microsoft says a China-aligned hacking group, Storm-0940, used an open-source AI penetration-testing tool called ARTEX to break into ConnectWise's Cloud Backup service, formerly SkyKick, and then reach customer Microsoft 365 tenants. The attribution comes from a Microsoft blog post dated October 21, 2026, as reported by Reuters and syndicated by outlets including AsiaOne. The attack itself was public days earlier: ConnectWise shut the service down on October 17.

This post separates three layers: what the vendors and responders confirmed about the intrusion, what Microsoft now claims about who did it and with what, and the numbers that do not agree across sources. It ends with a concrete check list for anyone who uses ConnectWise, SkyKick or any backup app with broad Microsoft 365 permissions. For the earlier ARTEX incidents, see our coverage of South Korea's AI-linked bank hacks and the ARTEX Global Edition fork.

TL;DR: confirmed vs claimed

What happened to ConnectWise Cloud Backup

BleepingComputer's October 17 report is the best timeline of the technical side. Administrators began noticing unauthorized access on a Friday, blaming a possible SkyKick or ConnectWise breach. Huntress then confirmed at least 162 compromised tenants in its own customer base, and Microsoft said it had seen unauthorized authentication attempts from one IP address on October 15.

ConnectWise's advisory said it "recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment" and shut down application access for partners and clients. By October 17 it had disabled seven application identities covering Cloud Backup and several Cloud Management integrations for Teams, Exchange Online, Microsoft Graph, Partner Center and SharePoint Online. On October 18 the company said scheduled backups were not running, and that SaaS Security and Cloud Management were offline as a precaution.

Why an app identity is such a big prize

Backup tools for Microsoft 365 work through an Entra ID service principal, which is the tenant-side representation of the software. Customers grant it broad permissions once, often years ago, so it can read mail, files and chats to back them up. According to Todyl researchers quoted by BleepingComputer, the attacker authenticated directly as the backup application using its secret and inherited whatever customers had already granted. Because no human logged in, MFA on user accounts never entered the picture.

Todyl said that in nine analyzed tenants it saw only sign-in activity and no evidence of new accounts, added permissions, password changes or persistence. Huntress saw something more aggressive in roughly 50 tenants it monitors: Cloud Management service principals assigning themselves directory roles, mostly Exchange Administrator. In one tenant, the Teams-related app granted itself Global Administrator and added credentials to a management tool, a step Huntress said took about five minutes. Microsoft assessed that the attacker likely abused existing permissions such as Directory.ReadWrite.All and observed Graph API reconnaissance and attempts to add credentials.

What Microsoft now claims about Storm-0940 and ARTEX

On October 21, per the Reuters-derived reports, Microsoft published its analysis. The key claims:

• The attack on ConnectWise's Cloud Backup service is attributed to Storm-0940, a group Microsoft has tracked since 2021.
• The group used ARTEX, described as an open-source penetration-testing framework that lets users connect any AI model to automate reconnaissance and data exfiltration.
• Microsoft says the ConnectWise-linked activity reached more than 2,250 tenants, with sign-in attempts peaking at 2,900 per minute. Separately, it counts more than 151,000 failed logon events from a related password-spray campaign.
• In multiple instances, less than three hours passed from initial targeting to privileged access, but Microsoft says most targeting was unsuccessful, while the group achieved privileged cloud persistence at many organizations.
• Targeted sectors included aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, semiconductors, software and think tanks.

ConnectWise's chief executive said the company had "contained the affected application connections and are restoring services in controlled phases," and added that those actions "do not remove unauthorized access that may have already been established within individual customer tenants." China's embassy in Washington said China opposes hacking and opposes smears against it on cybersecurity.

What we could and could not verify

The Storm-0940 and ARTEX details above match Microsoft's own October 21 post, which also says the ARTEX-driven activity began as early as September 2026. That is why this is a claimed-vs-verified post: the claims are Microsoft's own. The incident is verified by ConnectWise's own advisory and by three independent responders. The attribution and the AI-tool angle are Microsoft's assessment and should be read as such.

Two further cautions. First, tenant counts do not match: responders' confirmed-compromised figures (162, then 173) describe successful access, while the 2,250 figure appears to describe targeted tenants, most of which held. Second, "used an AI tool" does not tell us how autonomous the operation was. Public evidence from the earlier Korean case, summarized by CrowdStrike, showed an operator running ARTEX with models such as DeepSeek and leaving Claude Code session histories in open directories, which says more about tooling than about autonomy.

Why the AI angle matters, and where it does not

ARTEX is the third incident in October where a public agentic pentest framework appears in a real intrusion. In South Korea it was used for credential stuffing and reconnaissance against financial firms. In India, CERT-In warned that AI agents accessed organisations' live systems. Another case, a hacker who reportedly used agents for about five thousand dollars against Deere, SharkNinja and Cummins, points the same direction: automation lowers the cost of trying thousands of doors.

But the ConnectWise case also shows what AI did not change. The entry point was a shared application credential for a vendor service, a classic supply-chain weakness. Failed sign-ins at 2,900 per minute is a scale an agent can sustain, yet the damaging step was the successful use of already-granted permissions. Defenders who focus only on "AI attackers" and skip permission hygiene would miss the lesson. Our own felony-bench tracker follows incidents where agents act on real third parties, and this one fits the pattern of autonomy-assisted rather than autonomous attacks.

It also lands in a month of credential-theft stories: the LiteLLM 1.107.0 PyPI compromise and the Railway and OpenRouter attacks on AI API keys both ended with stolen secrets being replayed at scale.

What Microsoft 365 admins should do now

The vendors' guidance, as reported by BleepingComputer, WatchGuard and Techzine, boils down to these steps:

1. Find the apps. In Entra ID, look for ConnectWise Cloud Backup (application ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the Cloud Management apps for Exchange Online, Teams, Graph, Partner Center and SharePoint Online. Older tenants may list them as SkyKick Cloud Manager.
2. Disable them if you have not already, then review service principal sign-ins filtered by those IDs for unexpected source addresses. The IP address reported across responders was 144.172.64.128, and user agents such as curl and python-requests were seen.
3. Check secrets and certificates on every application for additions since October 13 and remove anything you did not add. The vendor shutdown does not remove credentials planted in your tenant.
4. Review role assignments. Look for service principals that granted themselves Exchange Administrator or Global Administrator.
5. Expect lingering tokens. Todyl warns that disabling an app stops new tokens but existing ones remain valid until they expire, and revoking user sessions does not end application-based access.
6. Audit all backup and migration tools. List which third-party apps hold Directory.ReadWrite.All or mailbox-wide access, and remove any you no longer use.

For teams that run AI agents with similar standing permissions, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

What readers are asking

Is this a Microsoft failure? Microsoft is reporting the incident and its tooling flagged the sign-ins, according to BleepingComputer. The weak point was a vendor's application credentials, not Microsoft 365 itself.

Does this mean AI hacking is now automatic? No. The public record shows AI frameworks speeding up reconnaissance and credential attempts. It does not show a fully autonomous breach, and Microsoft itself says most attempts failed.

Should I stop using backup apps? No, but treat them as privileged infrastructure: least-privilege consent, secret rotation, sign-in alerts for service principals, and a plan for the day the vendor is breached.

What to watch next

Three things will tell us how big this really is. First, ConnectWise's final root-cause statement: BleepingComputer noted the method used to obtain the vendor credentials was still unclear as of October 18. Second, whether Microsoft publishes indicators for ARTEX-driven traffic, since the tool's developer said it went closed-source after the Korean disclosures. Third, regulators: government and defense targets were named, so notification requirements could surface additional victims.

Related reading

• South Korea AI bank hacks and ARTEX
• ARTEX Global Edition fork
• CERT-In advisory on AI agents in live systems
• AI agents and a $5,000 breach spree
• LiteLLM 1.107.0 PyPI compromise
• Railway and OpenRouter attacks on AI keys
• PHP2Shell: what happened and what to do

Facts and figures are accurate as of October 22, 2026, based on ConnectWise, Huntress, Todyl and Microsoft statements as reported by BleepingComputer and Reuters-derived coverage. Counts may change as investigations continue.